> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # EKS Add-ons inputs: Metrics to terraform settings > Reference the EKS Add-ons module's Metrics, Traces, Grafana, Grafana sign-in, External secrets, Misc, Terraform settings inputs. **Type:** `rvn-eks-addons` / **Latest version:** `1.0.0` See [EKS Add-ons module reference](https://www.ravion.com/docs/module-definitions/catalog/rvn-eks-addons) for the full module page. ### Metrics **metrics\_enabled** `boolean` **Metrics.** Collect workload and Kubernetes metrics and send them to the selected destinations. Disabling metrics removes the managed metrics collectors. * Default: `true` **metrics\_providers** `string_array` **Metrics destinations.** Prometheus fits most clusters; Mimir is for clusters that outgrow it. Each external destination gets a copy. * Default: `["prometheus"]` * Allowed values: `amp` (Amazon Managed Prometheus), `prometheus` (Prometheus in your cluster), `mimir` (Grafana Mimir in your cluster (large clusters)), `cloudwatch` (Amazon CloudWatch (Container Insights)), `grafana_cloud` (Grafana Cloud Metrics), `datadog` (Datadog), `new_relic` (New Relic), `otlp` (Custom OTLP endpoint) * Shown when: `{"metrics_enabled":true}` **amp\_workspace\_id** `string` **Existing workspace ID.** Write into an existing Amazon Managed Prometheus workspace instead of creating one. Leave blank to create a workspace for this cluster. * Shown when: `{"metrics_enabled":true,"metrics_providers":"amp"}` **amp\_workspace\_region** `string` **Workspace region.** AWS Region containing the workspace. Leave blank to use the cluster Region. A different Region sends metrics across Regions. * Shown when: `{"metrics_enabled":true,"metrics_providers":"amp"}` **grafana\_role\_creation\_enabled** `boolean` **Amazon Managed Grafana access.** Assumable role for an Amazon Managed Grafana workspace to query this cluster's metrics and logs. No workspace is created. * Default: `false` * Shown when: `{"metrics_enabled":true}` **prometheus\_retention\_days** `number` **Prometheus retention (days).** Days of recent metrics Prometheus keeps on its own volume, apart from the history in S3. * Default: `15` * Min: `1` * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus"}` **prometheus\_storage\_size** `string` **Prometheus volume size.** Persistent volume size as a Kubernetes quantity, for example 50Gi. Requires a working storage class; Ravion clusters normally use the EBS CSI driver. * Default: `50Gi` * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus"}` **prometheus\_storage\_class** `string` **Prometheus storage class.** StorageClass of Prometheus's volume. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off. * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus"}` **prometheus\_s3\_storage\_enabled** `boolean` **Metrics history in S3.** Thanos uploads Prometheus's two-hour blocks to S3, keeps them for the S3 retention, and answers queries over both. Off, Prometheus keeps only its own volume. Ignored with an existing Prometheus URL. * Default: `true` * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus"}` **prometheus\_s3\_retention\_days** `number` **S3 retention (days).** Days of metrics history Thanos keeps in S3. Its compactor deletes older blocks, not a bucket lifecycle rule. * Default: `365` * Min: `1` * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}` **prometheus\_s3\_bucket\_name** `string` **Existing metrics bucket.** Store metrics history in an existing bucket instead of creating one. It must be dedicated to this cluster and in its region; customer-managed KMS grants remain your responsibility. * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus","prometheus_s3_storage_enabled":true}` **prometheus\_endpoint** `string` **Existing Prometheus URL.** In-cluster base URL of an existing Prometheus remote-write receiver. The module appends /api/v1/write and does not install Prometheus. * Shown when: `{"metrics_enabled":true,"metrics_providers":"prometheus"}` **mimir\_retention\_days** `number` **Mimir retention (days).** * Default: `365` * Min: `1` * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_s3\_bucket\_name** `string` **Existing Mimir bucket.** Store Mimir's metrics in an existing bucket instead of creating one. It must be dedicated to Mimir on this cluster and in its region; customer-managed KMS grants remain your responsibility. * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_storage\_class** `string` **Mimir storage class.** StorageClass of Mimir's volumes. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off. * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_zones** `string_array` **Mimir availability zones.** Three or more zones, one copy of every sample in each. Empty spreads copies across nodes. Nodes must be able to launch in every zone listed. * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_ingester\_replicas** `number` **Mimir ingesters.** Every series is held by three ingesters, so more ingesters each hold less of them. Each runs on its own node. * Default: `3` * Min: `3` * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_ingester\_cpu** `string` **Ingester CPU request.** * Default: `1` * Pattern: `^[0-9]+(\.[0-9]+)?m?$` — A CPU quantity such as 100m, 0.5, or 2. * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_ingester\_memory** `string` **Ingester memory.** Request and limit of each ingester, at roughly 5-8KiB per series it holds. Series from pods that have gone count until they age out. * Default: `6Gi` * Pattern: `^[0-9]+(Mi|Gi)$` — A memory quantity in Mi or Gi, such as 512Mi or 4Gi. * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **mimir\_ingester\_max\_series** `number` **Series limit per ingester.** An ingester refuses new series past this many, so a burst is rejected and retried instead of running every ingester out of memory. Blank for no limit. * Min: `1` * Shown when: `{"metrics_enabled":true,"metrics_providers":"mimir"}` **cloudwatch\_enhanced\_observability\_enabled** `boolean` **Enhanced observability.** * Default: `true` * Shown when: `{"metrics_enabled":true,"metrics_providers":"cloudwatch"}` **cloudwatch\_application\_signals\_enabled** `boolean` **Application Signals auto-instrumentation.** Enable AWS Application Signals auto-instrumentation. Existing pods receive the OpenTelemetry agent when they are recreated. * Default: `false` * Shown when: `{"metrics_enabled":true,"metrics_providers":"cloudwatch"}` **cloudwatch\_application\_signals\_namespaces** `string_array` **Namespaces to instrument.** Namespaces intended for Application Signals. This module publishes the list but does not add injection annotations. Leave empty to enable cluster-wide auto-monitoring. * Shown when: `{"cloudwatch_application_signals_enabled":true,"metrics_enabled":true,"metrics_providers":"cloudwatch"}` **cloudwatch\_observability\_addon\_version** `string` **CloudWatch add-on version.** Amazon CloudWatch Observability add-on version, for example v4.7.0-eksbuild.1. Leave blank to use the latest compatible version. Also applies to CloudWatch Logs. * Shown when: `{"metrics_enabled":true,"metrics_providers":"cloudwatch"}` **grafana\_cloud\_metrics\_url** `string` **Grafana Cloud remote-write URL.** Prometheus remote-write URL from your Grafana Cloud Metrics connection details. * Shown when: `{"metrics_enabled":true,"metrics_providers":"grafana_cloud"}` **grafana\_cloud\_metrics\_user** `string` **Grafana Cloud instance ID.** Numeric instance ID from your Grafana Cloud Metrics connection details. * Shown when: `{"metrics_enabled":true,"metrics_providers":"grafana_cloud"}` **grafana\_cloud\_metrics\_token\_secret\_arn** `string` **Grafana Cloud token secret ARN.** Secrets Manager ARN containing a Grafana Cloud token with metrics:write. The logs credential is reused when Grafana Cloud Logs is also selected. * Shown when: `{"logs_providers":{"not":"grafana_cloud"},"metrics_enabled":true,"metrics_providers":"grafana_cloud"}` **datadog\_metrics\_site** `string` **Datadog site.** * Default: `datadoghq.com` * Allowed values: `datadoghq.com` (US1 (datadoghq.com)), `us3.datadoghq.com` (US3 (us3.datadoghq.com)), `us5.datadoghq.com` (US5 (us5.datadoghq.com)), `datadoghq.eu` (EU1 (datadoghq.eu)), `ap1.datadoghq.com` (AP1 (ap1.datadoghq.com)), `ddog-gov.com` (US1-FED (ddog-gov.com)) * Shown when: `{"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}` **datadog\_metrics\_api\_key\_secret\_arn** `string` **Datadog API key secret ARN.** * Shown when: `{"logs_providers":{"not":"datadog"},"metrics_enabled":true,"metrics_providers":"datadog"}` **new\_relic\_metrics\_region** `string` **New Relic region.** * Default: `us` * Allowed values: `us` (United States), `eu` (Europe) * Shown when: `{"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}` **new\_relic\_metrics\_license\_key\_secret\_arn** `string` **New Relic license key secret ARN.** * Shown when: `{"logs_providers":{"not":"new_relic"},"metrics_enabled":true,"metrics_providers":"new_relic"}` **otlp\_metrics\_endpoint** `string` **OTLP metrics endpoint.** * Shown when: `{"metrics_enabled":true,"metrics_providers":"otlp"}` **otlp\_metrics\_headers\_secret\_arn** `string` **OTLP authorization secret ARN.** Secrets Manager ARN containing the complete Authorization header value. The logs credential is reused when the same OTLP destination is selected for logs. * Shown when: `{"logs_providers":{"not":"otlp"},"metrics_enabled":true,"metrics_providers":"otlp"}` ### Traces **traces\_enabled** `boolean` **Traces.** In-cluster OTLP receiver (gRPC 4317, HTTP 4318). Any pod can send to it. With metrics on, it also forwards workload metrics, which are billed per series. * Default: `true` **traces\_destinations** `object_array` **Trace destinations.** Send every trace to one or more destinations, each a card with its own settings. * Default: `[{"destination":"tempo"}]` * Shown when: `{"traces_enabled":true}` **item fields** **destination** `string` *required* **Destination.** * Allowed values: `tempo` (Tempo in your cluster), `xray` (AWS X-Ray), `grafana_cloud` (Grafana Cloud Traces), `datadog` (Datadog), `new_relic` (New Relic), `otlp` (Custom OTLP endpoint) **storage\_backend** `string` **Storage.** * Default: `s3` * Allowed values: `s3` (S3 bucket), `local` (Tempo's volume) * Shown when: `{"destination":"tempo"}` **s3\_bucket\_name** `string` **Existing S3 bucket.** S3 bucket name for trace storage. Leave blank to create a bucket. Lifecycle and encryption remain your responsibility for an existing bucket. * Shown when: `{"destination":"tempo","storage_backend":"s3"}` **retention\_days** `number` **Retention (days).** Number of days traces remain searchable in Tempo before deletion. Enter 1-3650. * Default: `30` * Min: `1` * Max: `3650` * Shown when: `{"destination":"tempo"}` **persistence\_enabled** `boolean` **Persistent volume.** Keep unflushed spans across restarts. Needs a StorageClass such as gp3. * Default: `true` * Shown when: `{"destination":"tempo"}` **persistence\_size** `string` **Volume size.** Size of Tempo's volume, as a Kubernetes quantity. * Default: `10Gi` * Shown when: `{"destination":"tempo"}` **storage\_class** `string` **Storage class.** StorageClass of Tempo's persistent volume. Leave blank for the managed gp3 class, or the cluster default when the EBS CSI driver is off. * Shown when: `{"destination":"tempo","persistence_enabled":true}` **metrics\_generator\_enabled** `boolean` **Service graphs and span metrics.** Writes service graphs and span metrics to Prometheus, which Grafana's service map uses. * Default: `false` * Shown when: `{"destination":"tempo"}` **cpu\_request** `string` **CPU request.** * Pattern: `^[0-9]+(\.[0-9]+)?m?$` — A CPU quantity such as 100m, 0.5, or 2. * Shown when: `{"destination":"tempo"}` **memory\_request** `string` **Memory request.** * Pattern: `^[0-9]+(Mi|Gi)$` — A memory quantity in Mi or Gi, such as 512Mi or 4Gi. * Shown when: `{"destination":"tempo"}` **memory\_limit** `string` **Memory limit.** One pod answers every trace query, so large dashboards are what push it over. Blank for 2Gi. * Pattern: `^[0-9]+(Mi|Gi)$` — A memory quantity in Mi or Gi, such as 512Mi or 4Gi. * Shown when: `{"destination":"tempo"}` **chart\_version** `string` **Chart version.** For example 3.1.0. * Shown when: `{"destination":"tempo"}` **helm\_values** `object` **Other Tempo chart values.** Any other Tempo chart values, as JSON, merged over the module's own: replicas, resources, ingestion limits and overrides, query tuning, tolerations. For example \{"tempo": \{"overrides": \{"defaults": \{"global": \{"max\_bytes\_per\_trace": 10000000}}}}}. * Default: `{}` * Shown when: `{"destination":"tempo"}` **region** `string` **Region.** Blank uses the cluster's region. * Shown when: `{"destination":"xray"}` **url** `string` **OTLP endpoint.** OTLP endpoint from your Grafana Cloud stack's OpenTelemetry connection details. * Shown when: `{"destination":"grafana_cloud"}` **user** `string` **Instance ID.** Numeric instance ID from your Grafana Cloud stack's OpenTelemetry connection details. * Shown when: `{"destination":"grafana_cloud"}` **token\_secret\_arn** `string` **Token secret ARN.** Secrets Manager ARN containing a Grafana Cloud token with traces:write. When Grafana Cloud is also a logs or metrics destination, that token is used. * Shown when: `{"destination":"grafana_cloud"}` **site** `string` **Datadog site.** Datadog site that receives traces. When Datadog is also a logs or metrics destination, that site is used. * Default: `datadoghq.com` * Allowed values: `datadoghq.com` (US1 (datadoghq.com)), `us3.datadoghq.com` (US3 (us3.datadoghq.com)), `us5.datadoghq.com` (US5 (us5.datadoghq.com)), `datadoghq.eu` (EU1 (datadoghq.eu)), `ap1.datadoghq.com` (AP1 (ap1.datadoghq.com)), `ddog-gov.com` (US1-FED (ddog-gov.com)) * Shown when: `{"destination":"datadog"}` **api\_key\_secret\_arn** `string` **API key secret ARN.** Secrets Manager ARN containing the Datadog API key. When Datadog is also a logs or metrics destination, that key is used. * Shown when: `{"destination":"datadog"}` **new\_relic\_region** `string` **New Relic region.** New Relic data region used to select the ingestion endpoint. When New Relic is also a logs or metrics destination, that region is used. * Default: `us` * Allowed values: `us` (United States), `eu` (Europe) * Shown when: `{"destination":"new_relic"}` **license\_key\_secret\_arn** `string` **License key secret ARN.** Secrets Manager ARN containing the New Relic license key. When New Relic is also a logs or metrics destination, that key is used. * Shown when: `{"destination":"new_relic"}` **endpoint** `string` **OTLP traces endpoint.** * Shown when: `{"destination":"otlp"}` **headers\_secret\_arn** `string` **Authorization secret ARN.** Secrets Manager ARN containing the complete Authorization header value for the traces endpoint. * Shown when: `{"destination":"otlp"}` ### Grafana **grafana\_enabled** `boolean` **In-cluster Grafana.** Grafana with data sources for the in-cluster Loki, Prometheus, Mimir and Tempo stores and Amazon Managed Prometheus. Without Access, reach it with a port-forward. * Default: `false` **grafana\_access\_enabled** `boolean` **Access.** Serve Grafana over HTTPS at a hostname, on a shared load balancer or through a Kubernetes Ingress. DNS is not managed. * Default: `false` * Shown when: `{"grafana_enabled":true}` **grafana\_access\_method** `string` **Served through.** * Default: `load_balancer` * Allowed values: `load_balancer` (Shared load balancer), `ingress` (Kubernetes Ingress) * Shown when: `{"grafana_access_enabled":true,"grafana_enabled":true}` **grafana\_load\_balancer** `string` **Load balancer.** * Default: `private` * Allowed values: `private` (Private), `public` (Public) * Shown when: `{"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}` **grafana\_ingress\_class\_name** `string` **Ingress class.** Blank uses the default IngressClass. Install its controller first. * Shown when: `{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}` **grafana\_hostname** `string` **Grafana hostname.** Point DNS at the load balancer, with a certificate that covers it. For Tailscale, `..ts.net`. * Shown when: `{"grafana_access_enabled":true,"grafana_enabled":true}` **grafana\_listener\_rule\_priority** `number` **Listener rule priority.** Explicit rule order on the chosen load balancer's HTTPS listener. Leave blank to let AWS assign the next available priority. * Shown when: `{"grafana_access_enabled":true,"grafana_access_method":"load_balancer","grafana_enabled":true}` **grafana\_ingress\_annotations** `object` **Ingress annotations.** Annotations for the Ingress, as JSON, passed to it as they are, such as \{"cert-manager.io/cluster-issuer": "letsencrypt"} or \{"tailscale.com/tags": "tag:grafana"}. * Default: `{}` * Shown when: `{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}` **grafana\_ingress\_tls\_secret\_name** `string` **TLS secret.** Kubernetes Secret holding the hostname's certificate, for controllers that read one, such as nginx with cert-manager. Leave blank where the controller provides the certificate, as Tailscale does. * Shown when: `{"grafana_access_enabled":true,"grafana_access_method":"ingress","grafana_enabled":true}` **grafana\_environment\_variables** `array` **Environment variables.** Grafana reads any setting from `GF_
_`. * Shown when: `{"grafana_enabled":true}` **grafana\_secrets** `array` **Secrets.** `{name, value_from}` with a Secrets Manager or SSM ARN, read in-cluster. Use `GF_AUTH__CLIENT_SECRET` for a sign-in client. * Shown when: `{"grafana_enabled":true}` **grafana\_cpu\_request** `string` **Grafana CPU request.** * Default: `100m` * Pattern: `^[0-9]+(\.[0-9]+)?m?$` — A CPU quantity such as 100m, 0.5, or 2. * Shown when: `{"grafana_enabled":true}` **grafana\_memory\_request** `string` **Grafana memory request.** * Default: `256Mi` * Pattern: `^[0-9]+(Mi|Gi)$` — A memory quantity in Mi or Gi, such as 512Mi or 4Gi. * Shown when: `{"grafana_enabled":true}` **grafana\_memory\_limit** `string` **Grafana memory limit.** Many dashboards or alert rules need more; Grafana evaluates alert rules itself. * Default: `512Mi` * Pattern: `^[0-9]+(Mi|Gi)$` — A memory quantity in Mi or Gi, such as 512Mi or 4Gi. * Shown when: `{"grafana_enabled":true}` ### Grafana sign-in **grafana\_default\_role** `string` **Role for new accounts.** Grafana role an account gets the first time it signs in through an OAuth provider, unless the provider's role mapping says otherwise. * Default: `Viewer` * Allowed values: `Viewer`, `Editor`, `Admin` * Shown when: `{"grafana_enabled":true}` **grafana\_auth\_providers** `object_array` **Sign-in providers.** Without Username and password there's no login form. Google, GitHub and gitlab.com need a domain, org, team or group restriction. * Default: `[{"provider":"basic"}]` * Shown when: `{"grafana_enabled":true}` **item fields** **provider** `string` *required* **Provider.** * Allowed values: `basic` (Username and password), `google` (Google), `github` (GitHub), `gitlab` (GitLab), `azuread` (Microsoft Entra ID), `okta` (Okta), `generic_oauth` (Generic OAuth) **name** `string` **Button label.** * Shown when: `{"provider":"generic_oauth"}` **client\_id** `string` **Client ID.** Leave blank when Secrets gives `GF_AUTH__CLIENT_ID`. Redirect URI: `https:///login/`. * Shown when: `{"provider":{"not":"basic"}}` **client\_secret\_arn** `string` **Client secret ARN.** Secrets Manager ARN of the plain-text client secret. Leave blank when Secrets gives `GF_AUTH__CLIENT_SECRET`. * Shown when: `{"provider":{"not":"basic"}}` **tenant\_id** `string` **Tenant ID.** Directory (tenant) ID of the app registration. Roles come from the app registration's app roles. * Shown when: `{"provider":"azuread"}` **url** `string` **URL.** Okta: your org URL. GitLab: a self-managed GitLab's base URL; leave blank for gitlab.com. * Shown when: `{"provider":["gitlab","okta"]}` **auth\_url** `string` **Authorization URL.** * Shown when: `{"provider":"generic_oauth"}` **token\_url** `string` **Token URL.** * Shown when: `{"provider":"generic_oauth"}` **api\_url** `string` **User info URL.** * Shown when: `{"provider":"generic_oauth"}` **scopes** `string` **Scopes.** Space-separated. Blank uses Grafana's default. Google Workspace groups also need `https://www.googleapis.com/auth/cloud-identity.groups.readonly`. * Shown when: `{"provider":{"not":"basic"}}` **allowed\_domains** `string_array` **Allowed domains.** Email domains whose accounts can sign in. For Google, your Google Workspace domains. * Shown when: `{"provider":{"not":"basic"}}` **allowed\_organizations** `string_array` **Allowed organizations.** GitHub organizations, Entra ID tenant IDs, or the provider's organizations whose members can sign in. * Shown when: `{"provider":["github","azuread","generic_oauth"]}` **allowed\_groups** `string_array` **Allowed groups.** Groups whose members can sign in. Google takes Workspace group emails, and needs the Cloud Identity groups scope under Scopes. Entra ID takes group object IDs. * Shown when: `{"provider":["google","gitlab","azuread","okta","generic_oauth"]}` **team\_ids** `string_array` **Allowed team IDs.** Numeric IDs of teams whose members can sign in. * Shown when: `{"provider":["github","generic_oauth"]}` **role\_attribute\_path** `string` **Role mapping.** JMESPath over user info that returns Admin, Editor or Viewer, checked at every sign-in. Blank uses the default role. * Shown when: `{"provider":{"not":["azuread","basic"]}}` **settings** `object` **Other Grafana settings.** Any other key of Grafana's \[auth.\] section, as JSON, passed through verbatim, such as \{"auto\_login": "true"}. The client secret goes in the ARN above, never here. * Default: `{}` * Shown when: `{"provider":{"not":"basic"}}` ### External secrets **eso\_enabled** `boolean` **External Secrets Operator.** * Default: `true` **eso\_secret\_and\_parameter\_arns** `string_array` **Readable secret ARNs.** Wildcards allowed. Empty allows every secret and parameter in this account and region. * Shown when: `{"eso_enabled":true}` **eso\_allowed\_namespaces** `string_array` **Allowed namespaces.** Namespaces whose ExternalSecrets may use the shared stores. Empty allows the namespaces Ravion Operator manages. Add custom service namespaces here. * Shown when: `{"eso_enabled":true}` **eso\_chart\_version** `string` **Chart version.** External Secrets Helm chart version without a leading v, for example 2.11.0. * Shown when: `{"eso_enabled":true}` **eso\_namespace** `string` **Operator namespace.** Created if missing. * Shown when: `{"eso_enabled":true}` ### Misc **tags** `keyvalue` **Tags.** A map of tags to assign to all resources. Default tags are `Owner`, `ProjectGivenId`, `EnvironmentGivenId`, `ModuleGivenId`, `ModuleId` ### Terraform settings **opentofu\_version** `string` **OpenTofu version override.** Override the environment's default version for this module **ravion\_state\_backend\_workspace** `string` **Ravion Terraform workspace name.** Override Terraform state backend workspace name. Defaults to project + environment + module given ids. * Immutable after creation **terraform\_plan\_default\_policies\_enabled** `boolean` **Include default plan policies.** Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below. * Default: `true` **terraform\_plan\_iam\_policy\_arns** `string_array` **Terraform plan IAM policies.** IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **terraform\_apply\_default\_policies\_enabled** `boolean` **Include default apply policies.** Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below. * Default: `true` **terraform\_apply\_iam\_policy\_arns** `string_array` **Terraform apply IAM policies.** IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-\ bucket in this account. * Default: `[]` **advanced\_terraform\_variables** `object` **Advanced Terraform variables.** Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above. * Default: `{}` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.